package org.chipu.jnids.sce;

import java.util.*;
import org.chipu.jnids.alert.AlertEvent;
import org.chipu.jnids.beans.Snapshot;
import org.chipu.jnids.sce.profile.AnormalMessage;
import org.chipu.jnids.sce.profile.AnormalStateEngine;

public class StateCorrelationEngine {
	public static final StateCorrelationEngine INSTANCE = new StateCorrelationEngine();
	private final Map<AlertEvent, Snapshot> snapshots = Collections.synchronizedMap(new HashMap<AlertEvent, Snapshot>());

	private StateCorrelationEngine() {/**/}

	public void associateSnapshot(AlertEvent ev, Snapshot snapshot) {
		snapshots.put(ev, snapshot);
	}

	public void unassociateSnapshot(AlertEvent ev) {
		snapshots.remove(ev);
	}

	/**
	 * Used to unify alerts from the different sensors.<br>
	 * If source, destination, and URL of two events are the same and the timestamps are close, the two events are
	 * linked and further on treated as a single event.<br>
	 * It also completes the first alert with the added info of the second one.
	 */
	public boolean isAlreadyProcessed(AlertEvent ev) {
		// if the previous alert was discarded -> give high priority and danger
		// TODOLATER
		return false;
	}

	/** The system is configured by the admin to ignore these alerts */
	public boolean shouldBeIgnored(AlertEvent ev) {
		// TODOLATER
		return false;
	}

	/**
	 * It is not a danger:<br>
	 * <li>It is related to some service that is not enabled in the host <li>The service is parched against this exploit
	 * <li>NIDS detects an attack against a host but the attack traffic is blocked by a firewall
	 */
	public boolean isNotHazard(AlertEvent ev) {
		// TODOLATER
		return false;
	}

	/** @return the anormality traffic */
	public byte getAnormalActivityLevel(AlertEvent ev) {
		List<AnormalMessage> anormalState = AnormalStateEngine.getAnormalState(snapshots.get(ev));
		byte anormalLevel = 0;
		if (anormalState != null)
			for(AnormalMessage msg : anormalState)
				anormalLevel += msg.importance.getValue();
		//FIXME the number here is not consistant if we have more than 1 (white) profile
		return anormalLevel;
	}
}